How severe is CVE-2026-33697?

CVE-2026-33697 has a CVSS score of 6.3 (Medium severity). EPSS score: 0.00% (0th percentile), indicating the estimated probability of exploitation in the wild.

Armis Vulnerability Intelligence Database

By combining AI with human insight, Armis Vulnerability Intelligence Database offers extended coverage for vulnerabilities that matter to you, your industry, and provides you with clear remediation instructions.

CVE Name	Severity Score	Published Date	CISA KEV

Take These Insights to the Next Level

Armis now offers direct API access to Armis Vulnerability Intelligence Database through the AWS Marketplace, transforming it from a powerful research tool into an integrated component of your proactive security posture.

Seamless Integration: Directly feed Armis's contextual data into your existing stack.
Automated Workflows: Automate vulnerability lookups in real-time.
Custom Solutions: Use the raw data to build custom dashboards, reports, alerts.

GET THE API

Perspectives, Insights, and News

This Year Vulnerability Management Moves from the Basement to the C-suite

The evolution of cybersecurity practices are reshaping how organizations tackle vulnerabilities.

READ BLOG→

Closing the Loop

Making security everyone's business with prioritization and collaboration.

READ CASE STUDY→

The State of Cyberwarfare

The state of Cyberwarfare

LEARN MORE→

CVE-2026-33697:

Cocos AI is a confidential computing system for AI. The current implementation of attested TLS (aTLS) in CoCoS is vulnerable to a relay attack affecting all versions from v0.4.0 through v0.8.2. This vulnerability is present in both the AMD SEV-SNP and Intel TDX deployment targets supported by CoCoS. In the affected design, an attacker may be able to extract the ephemeral TLS private key used during the intra-handshake attestation. Because the attestation evidence is bound to the ephemeral key but not to the TLS channel, possession of that key is sufficient to relay or divert the attested TLS session. A client will accept the connection under false assumptions about the endpoint it is communicating with — the attestation report cannot distinguish the genuine attested service from the attacker's relay. This undermines the intended authentication guarantees of attested TLS. A successful attack may allow an attacker to impersonate an attested CoCoS service and access data or operations that the client intended to send only to the genuine attested endpoint. Exploitation requires the attacker to first extract the ephemeral TLS private key, which is possible through physical access to the server hardware, transient execution attacks, or side-channel attacks. Note that the aTLS implementation was fully redesigned in v0.7.0, but the redesign does not address this vulnerability. The relay attack weakness is architectural and affects all releases in the v0.4.0–v0.8.2 range. This vulnerability class was formally analyzed and demonstrated across multiple attested TLS implementations, including CoCoS, by researchers whose findings were disclosed to the IETF TLS Working Group. Formal verification was conducted using ProVerif. As of time of publication, there is no patch available. No complete workaround is available. The following hardening measures reduce but do not eliminate the risk: Keep TEE firmware and microcode up to date to reduce the key-extraction surface; define strict attestation policies that validate all available report fields, including firmware versions, TCB levels, and platform configuration registers; and/or enable mutual aTLS with CA-signed certificates where deployment architecture permits.

CVE-2026-33697:

Armis Vulnerability Intelligence Database

Take These Insights to the Next Level

Perspectives, Insights, and News

This Year Vulnerability Management Moves from the Basement to the C-suite

Closing the Loop

The State of Cyberwarfare

Focus on What Matters

Let's talk!

CVE-2026-33697:

CVE-2026-33697:

Score
A numerical rating that indicates how dangerous this vulnerability is.

Threat Predictions

Exploitability

Impact

Description Preview

Industries Affected

CVE-2026-33697:

Armis Vulnerability Intelligence Database

Take These Insights to the Next Level

Perspectives, Insights, and News

This Year Vulnerability Management Moves from the Basement to the C-suite

Closing the Loop

The State of Cyberwarfare

Focus on What Matters

Let's talk!

CVE-2026-33697:

CVE-2026-33697:

ScoreA numerical rating that indicates how dangerous this vulnerability is.

Threat Predictions

Exploitability

Impact

Description Preview

Industries Affected

More Medium CVEs

Score
A numerical rating that indicates how dangerous this vulnerability is.